Skip to content

Instantly share code, notes, and snippets.

@nathansmith
Last active August 29, 2015 14:04
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save nathansmith/a89c98b74e7a9ad242ce to your computer and use it in GitHub Desktop.
Save nathansmith/a89c98b74e7a9ad242ce to your computer and use it in GitHub Desktop.
Paste this into browser console, to illustrate why arbitrary script execution is bad.
(function(d) {
'use strict';
// DOM elements.
var body = d.body;
var html = d.documentElement;
var head = d.head || d.getElementsByTagName('head')[0];
// Style attributes.
var b = body.style;
var h = html.style;
// Dimensions.
var y = '100%';
var x = y+' '+y;
// Image URL.
var u = 'url(http://f.cl.ly/items/1L150h2J2d3l0E3K1B3i/f.gif)';
// Destroy <head> and <body> content.
head.innerHTML = '';
body.innerHTML = '';
// Zero out margin/padding.
b.margin = 0;
b.padding = 0;
// Make page full height.
h.height = y;
b.height = y;
// Ensure background covers.
b.backgroundSize = x;
// Add the GIF.
b.backgroundImage = u;
})(this.document);
@nathansmith
Copy link
Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment